SAA-C03 Practice Test 10 — 10 Questions

Question 1

A company has a high-performance database running on Amazon RDS for MySQL. The workload is read-heavy and experiences latency during peak hours. Which solution will improve read performance with minimal architectural changes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create one or more RDS Read Replicas and update the application connection string.. Creating an RDS Read Replica allows the application to offload read-only traffic from the primary database instance. By routing read queries to the replica, the primary instance can focus solely on write operations. This architecture is a standard practice for scaling read-heavy workloads in relational databases, ensuring lower latency and better resource utilization without requiring significant code modifications or complex database sharding.

Answer

Enable Multi-AZ deployment for the existing RDS instance.

Answer

Increase the instance size to a larger DB instance class.

Answer

Migrate the database to Amazon DynamoDB.

Question 2

An organization wants to identify and eliminate waste in their AWS account. They are specifically looking for idle resources that are still incurring charges. Which THREE AWS tools or features can help identify these cost-optimization opportunities?

Accepted Answer

AWS Trusted Advisor.. AWS Trusted Advisor (A) is correct because its Cost Optimization checks specifically flag idle or underutilized resources that still incur charges, such as unassociated Elastic IP addresses, idle load balancers, and underutilized Amazon EC2 instances. AWS Compute Optimizer (B) is correct because it analyzes CloudWatch metrics to generate recommendations for over-provisioned resources, including idle or underutilized EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions, directly surfacing cost-optimization opportunities. AWS Cost Explorer Rightsizing Recommendations (C) is correct because it uses historical utilization data to recommend resizing or terminating idle/underutilized EC2 instances, helping eliminate waste from over-provisioned compute. AWS CloudTrail (D) is not correct because it records API activity for auditing, security, and compliance, not for identifying idle resources or cost waste. Amazon Inspector (E) is not correct because it is a vulnerability management service that scans workloads for security exposures, not a cost-optimization or idle-resource detection tool.

Answer

AWS CloudTrail.

Answer

Amazon Inspector.

Question 3

An organization needs to improve the resilience of its EC2-based application. Which THREE actions should the architect perform? (Select THREE.)

Accepted Answer

Distribute EC2 instances across multiple Availability Zones.. Option A is correct because distributing EC2 instances across multiple Availability Zones ensures the application survives the failure of an entire AZ, since each AZ has independent power, cooling, and networking. Option B is correct because an Auto Scaling group continuously performs health checks and automatically replaces unhealthy instances, restoring capacity without manual intervention. Option D is correct because load balancer health checks detect unhealthy targets and stop routing traffic to them, so users are only sent to functioning instances. Option C is wrong because a single large instance is a single point of failure and does not improve resilience. Option E is wrong because a fixed-capacity Auto Scaling group cannot scale out to absorb load or compensate for lost capacity, so it does not meaningfully improve resilience.

Answer

Use a single large EC2 instance instead of multiple smaller ones.

Answer

Place all instances in a single Auto Scaling group with a fixed capacity.

Question 4

A company needs to store database credentials for an application running on Amazon ECS. The credentials must be encrypted and automatically rotated every 30 days without requiring an application restart. Which TWO AWS services should be used together to achieve this? (Select TWO)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (A) is correct because it is purpose-built to store and encrypt database credentials and natively supports automatic rotation on a schedule such as every 30 days, so the ECS application can retrieve the latest secret without a restart. AWS Lambda (B) is correct because Secrets Manager rotation is implemented by a Lambda rotation function that performs the four-step rotation (createSecret, setSecret, testSecret, finishSecret) against the database. AWS Systems Manager Parameter Store (C) can hold encrypted parameters but does not provide built-in automatic rotation, so it does not meet the 30-day rotation requirement. AWS Key Management Service (D) provides the encryption keys used by Secrets Manager but is not itself a secret store or rotation scheduler, so it is not one of the two services to use together. Amazon DynamoDB (E) is a NoSQL database service and has no role in storing or rotating application credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

Amazon DynamoDB

Question 5

A company is designing a mission-critical database architecture using Amazon RDS. Which TWO steps should the architect take to ensure high availability and data durability? (Select TWO.)

Accepted Answer

Enable Multi-AZ deployment for the RDS instance.. Option A is correct because an RDS Multi-AZ deployment maintains a synchronous standby replica in a different Availability Zone, and RDS automatically fails over to that standby if the primary instance or its AZ fails, which directly provides high availability for a mission-critical database. Option C is correct because enabling automated backups with a defined retention period gives point-in-time recovery (PITR) to any second within the retention window (up to 35 days), which ensures data durability and recoverability from corruption or accidental deletion. Option B is not appropriate because a Read Replica in the same AZ is asynchronous, does not provide automatic failover, and would not survive an AZ-level outage. Option D is incorrect because gp2 is just one storage option and choosing it does not by itself deliver high availability or durability. Option E is incorrect because disabling deletion protection increases the risk of accidental data loss rather than protecting the database.

Answer

Configure a Read Replica in the same Availability Zone.

Answer

Set the storage type to General Purpose SSD (gp2) only.

Answer

Disable the deletion protection feature for all instances.

Question 6

A security team is concerned about accidental or malicious deletion of critical objects in an Amazon S3 bucket. Which TWO features should be enabled to prevent permanent data loss and require additional authentication for deletions?

Accepted Answer

S3 Versioning.. S3 Versioning (A) is correct because it keeps multiple variants of an object in the same bucket, so when an object is overwritten or deleted, a delete marker is placed and the prior version remains recoverable, preventing permanent data loss from accidental or malicious deletion. MFA Delete (B) is correct because it adds an additional authentication factor requirement for permanently deleting object versions or changing the versioning state of the bucket, directly satisfying the requirement for extra authentication on deletions. Together, versioning preserves the data and MFA Delete protects the destructive operations. S3 Object Lock in compliance mode (C) is not among the marked answers and, while it prevents deletion for a retention period, it does not itself require additional authentication for deletions. S3 Inventory (D) only provides scheduled reports of objects and metadata, and S3 Transfer Acceleration (E) only speeds up uploads/downloads via edge locations; neither prevents permanent deletion or adds authentication.

Answer

S3 Object Lock in compliance mode.

Answer

S3 Inventory.

Answer

S3 Transfer Acceleration.

Question 7

A company is running a development environment on Amazon RDS for MySQL. The environment is only used by developers during business hours (09:00 to 17:00, Monday through Friday). The company wants to minimize costs for these database instances. Which TWO actions should the company take?

Accepted Answer

Stop the RDS instances when they are not in use.. Option A is correct because stopping an RDS for MySQL instance when it is not in use eliminates instance-hour charges for the DB instance (you still pay for allocated storage and backups), which directly reduces cost for a dev environment idle outside 09:00–17:00 Monday–Friday. Option C is correct because AWS Instance Scheduler lets you define start/stop schedules (e.g., via CloudFormation-deployed Lambda and DynamoDB) so the instances automatically stop at 17:00 and start at 09:00 on business days, avoiding manual intervention and ensuring the savings from Option A are realized consistently. Option B is not appropriate because Multi-AZ deployments run a synchronous standby replica, roughly doubling cost and adding no benefit for a non-production dev environment. Option D is not appropriate because All Upfront Reserved Instances commit to 24/7 usage for a 1- or 3-year term, which is wasteful for instances used only ~40 hours per week. Option E is not appropriate because migrating to DynamoDB is a major re-architecture away from MySQL and does not address the goal of minimizing cost for the existing RDS instances.

Answer

Convert the RDS instances to Multi-AZ deployments.

Answer

Purchase All Upfront Reserved Instances for the development environment.

Answer

Move the databases to Amazon DynamoDB to utilize on-demand scaling.

Question 8

A solutions architect is designing a storage solution for a financial firm. The firm requires that data stored in Amazon S3 must be protected against accidental deletion and all changes to the data must be versioned. Which TWO features should the architect implement to meet these requirements? (Select TWO)

Accepted Answer

Enable S3 Versioning on the bucket.. Option A is correct because enabling S3 Versioning on the bucket preserves every prior version of an object, so overwrites and deletes create new versions rather than destroying data, directly satisfying the requirement that all changes to the data be versioned. Option B is correct because MFA Delete adds a second authentication factor requiring the bucket owner's MFA token plus a valid request to permanently delete an object version or to suspend versioning, which protects the versioned data against accidental or malicious deletion. Together, Versioning provides the version history and MFA Delete guards the deletion of those versions, which is exactly the combination the financial firm needs. Option C is not appropriate because Lifecycle policies only transition or expire objects and do not provide versioning or deletion protection. Option D is not appropriate because S3 Object Lock in Governance mode enforces a retention period (WORM) rather than versioning all changes, and Governance mode can be bypassed by users with special permissions. Option E is not appropriate because Block Public Access only restricts public exposure of the bucket and has nothing to do with versioning or protecting against deletion.

Answer

Implement S3 Lifecycle policies to move data to Glacier.

Answer

Configure a Default Retention Period using S3 Object Lock in Governance mode.

Answer

Use S3 Block Public Access at the account level.

Question 9

A media streaming company stores millions of video assets in an Amazon S3 bucket. Compliance regulations mandate that objects must be protected against accidental deletion, malicious tampering, and region-wide disasters. The solution must prevent permanent deletion even by users with root credentials during a retention period. Which combination of features meets these requirements?

Accepted Answer

Enable S3 Versioning, configure S3 Object Lock in compliance mode, and set up S3 Cross-Region Replication to another AWS Region.. Enabling S3 Versioning preserves every version of every object, protecting against accidental overwrites and deletions. Configuring S3 Object Lock in compliance mode ensures that objects cannot be deleted or modified by any user, including the root account, until the retention period expires. Finally, S3 Cross-Region Replication protects against catastrophic regional disasters by maintaining synchronized copies.

Answer

Enable S3 Versioning, apply an S3 Lifecycle rule to transition objects to S3 Glacier, and configure AWS Backup vaults.

Answer

Apply strict AWS Identity and Access Management (IAM) bucket policies denying s3:DeleteObject, and enable server-side encryption.

Answer

Configure Amazon S3 Intelligent-Tiering, enable Multi-Factor Authentication (MFA) Delete, and attach bucket policies.

Question 10

A company has several VPCs in a single region that need to access an S3 bucket for data processing. Currently, traffic goes through a NAT Gateway in each VPC. What is the most cost-effective way to provide access to S3?

Accepted Answer

Set up a Gateway VPC Endpoint for S3 in each VPC.. Gateway VPC Endpoints for S3 are free of charge and provide a direct, private connection to S3 within the AWS network. By replacing NAT Gateways—which charge per-hour and per-GB of data processed—with Gateway Endpoints, the company eliminates data transfer costs and the hourly gateway fee for S3-bound traffic.

Answer

Create an Interface VPC Endpoint for S3 in each VPC.

Answer

Deploy a single NAT Instance in a shared services VPC.

Answer

Use a Transit Gateway to route all S3 traffic through a central VPC.